01-25-2011 02:36 PM
We have deployed EV Journaling in a very, very large environment. I have already come across some failed DL Expansions. They are in the Failed DLs Folder in the journal mailbox as you would expect.
I know I can change the policy to archive even if one of the DLs fails to expand, but this leaves me open to potentially having valid DL Expansion fail and the item be put in the archive and be unsearchable. This is a problem.
Does anyone have a best practice to deal with this? I don't see manually moving failed items back into the Journal Inbox as a practical solution... simply due to the scope of administering this solution.
Am I missing an obvious solution to this issue?
Thanks!!
Solved! Go to Solution.
01-26-2011 08:59 AM
actually you're right i'm talking crap, its not that big of a deal if you use envelope journaling, if you don't use envelope journaling (only in 2003, you can't turn off envelope journaling in 2007 or 2010) then you'd have a problem
The real issue would be detection of BCC/undisclosed recipients
01-25-2011 03:15 PM
there is an option to move failed items back in to the inbox in the Advanced archive settings of the journal policy
01-26-2011 08:34 AM
Then there will be an e-mail discoverable by name that was received by the DL Member.
Given this, is it really a big deal if a valid DL Fails to expand occasionally? What do you think?
Thanks for the input!
01-26-2011 08:43 AM
it can be a big deal because it would be harder to prove that an item was received by someone
So for instance if you search on DL-myDistList 2 years after its been archived, who knows who has been added and removed from that list, you can "assume" someone received something, but you can't prove it unless you have backups of AD to that point when it was sent/received
01-26-2011 08:50 AM
There is a copy of that e-mail in the DL Member's inbox that gets journaled/archived correct? So if I search on everything associated with a user, (we never search on a DL) the received e-mail will be in the journal archive, thus discoverable. That would be proof the message was received, No?
Thanks!!
01-26-2011 08:59 AM
actually you're right i'm talking crap, its not that big of a deal if you use envelope journaling, if you don't use envelope journaling (only in 2003, you can't turn off envelope journaling in 2007 or 2010) then you'd have a problem
The real issue would be detection of BCC/undisclosed recipients
01-26-2011 01:09 PM
We are doing Journaling at the Hub Transport and we see BCCs in the envelope. Seems like we really don't need DL Expansion once we are on Exchange 2007. Agreed?
Thanks!!
01-26-2011 01:21 PM
Well the thing is the Envelope Message (P1) will contain all the people that received it, you're right, but it does not denote whether they were To, CC or BCC
So lets say I sent a message to DL-HelpDesk and it has the following members
User A, User B, User C, User D
I send message such as
Subject: Not enough imagination to think of one
To: DL-HelpDesk
BCC: User E
The message hits the inbox and in the P1 message of the envelope it has the following recipients
User A
User B
User C
User D
User E
From the above you can't actually tell whether they were sent to as a DL, individually or in the BCC field, so what Enterprise Vault does is it then opens up the actual message (the P2 message) and it compares the To and CC lines
It will then see that the only recipient is DL-HelpDesk, so then it goes to Exchange and then does a cross check of each user,and it will then see that User E is not in DL-HelpDesk, and he's not in to the To line or the CC line, so therefor he is an undisclosed recipient
It then gets added to the index as an RBCC field and a couple of others denoting that the user is a BCC recipient